11608742819[.]zip | Triage

Sharing

Copy URL Twitter E-mail

General

Target

11608742819.zip
Size

504KB
MD5

0405b884fdbf281a2311ad4ffbebf121
SHA1

e2e1163b608b9da4cf138156cad678f93174c4c0
SHA256

51029d37c2bf302d62535cdff791b98b8e318c1fe63a2a83ee82f212db27e452
SHA512

481d4e234fdf718bd31e612884f9e4b62adcd88c0a0790cad318b4f906a0c378227cfc14c84a31cc31aec379d7084a21d18e966c85a6b86ec61a14f7e5178014
SSDEEP

12288:A8DN9+bMcyeYcgS+KipEByP4M/v8xj/W2:Fb6RKDAkvo/W2

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/7d391d1948b2031b481efb8e2df608c2b048d34c49a6402ef0a57299f4540730

Files

11608742819.zip
.zip

Password: infected
7d391d1948b2031b481efb8e2df608c2b048d34c49a6402ef0a57299f4540730
.exe windows x86

Password: infected

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

\5!`5
Size: 1024B - Virtual size: 632B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 1.7MB - Virtual size: 1.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 166KB - Virtual size: 166KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ